Malicious PDF — malware analysis report

Static analysis result for SHA-256 a63dd9edab6cad6c…

MALICIOUS

PDF

80.0 KB Created: 2021-09-13 07:03:28 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-16
MD5: ec2302b75d52b202880ef3471811825f SHA-1: d30ff3a60dd65009d6f44dcf330c3c110d493099 SHA-256: a63dd9edab6cad6c5a36a8da9b00f107ddc6b7520baaadbd5a328d0152c34784
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains numerous embedded URLs pointing to external domains, indicating a redirection or phishing attempt. The ClamAV heuristic specifically flags it as 'Pdf.Phishing.Trojan', strongly suggesting malicious intent. The heuristic 'PDF_SEO_DISPOSABLE_LINK_FARM' further supports that the PDF is designed to host many links on disposable domains, likely to obscure the final malicious destination.

Machine Learning

  • Nyx PDF Classifier suspicious score 0.4210

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pixomot.ru/uplcv?utm_term=best+mmorpg+games+android+2020 PDF link annotation
    • http://073741256.com/uploads/files/202109122208437727.pdfIn PDF document text
    • http://autoscuolauniversale.it/userfiles/files/27043679899.pdfIn PDF document text
    • http://deurwater.com/wp-content/plugins/formcraft/file-upload/server/content/files/16135e6cfc1e95---wejibaduripuvanewezep.pdfIn PDF document text
    • http://hitecds.com/userfiles/file/30062351980.pdfIn PDF document text
    • http://rintoyo.com/userfiles/file/58963664022.pdfIn PDF document text
    • http://www.dkmodels.net/ckfinder/userfiles/files/28518494593.pdfIn PDF document text
    • http://milkexim.ru/imgeditor/file/zimitirebomemepuvalo.pdfIn PDF document text
    • http://totoumi.jp/upload/file/zamujebafulen.pdfIn PDF document text
    • http://xn--939a66v0zjo3bcvdmrp.com/data/ckfinder/files/53504001142.pdfIn PDF document text
    • http://a1climbing.com/userfiles/files/30399923979.pdfIn PDF document text
    • https://hygradeinsulators.com/images/uploads/file/dasipizatepebetixorod.pdfIn PDF document text
    • https://latrinquette.com/upload/editor/file/31104847773.pdfIn PDF document text
    • http://antitumor.org/filespath/files/20210901232151.pdfIn PDF document text
    • https://nutstudio.it/userfiles/file/31709773419.pdfIn PDF document text
    • http://alessandrobelleseveterinario.eu/userfiles/files/42314946917.pdfIn PDF document text
    • https://esvigo.com/upload/files/leviwuvapuzuduxuneji.pdfIn PDF document text
    • http://tainanrup.longi.tw/uploadfiles/files/20210902_075650_5357.pdfIn PDF document text
    • https://danielstrehlau.com/userfiles/file/bozaga.pdfIn PDF document text
    • http://www.anclupnapoli.it/userfiles/file/56116963169.pdfIn PDF document text
    • http://solmoda.it/userfiles/files/11550045806.pdfIn PDF document text
    • http://cdkuysuujk.handysociality.com/upload/files/24714386863.pdfIn PDF document text
    • http://jmyhship.com/uploadfile/files/97396211567.pdfIn PDF document text
    • http://rbtyutj01.com/userfiles/files/wezidasaxibogujo.pdfIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ee78.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEE78 10984 bytes
SHA-256: 6bb775618cb29c95c8d9465e377cf102462f74546522fc21d3e143b71606dfa3
font_01_sfnt_off000107cf.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x107CF 16400 bytes
SHA-256: ce4545e4c1957236a611ac0fae77e68f219518b2ed5deb0e88e936e787035a9e

Open this report in the interactive analyzer, or submit your own file for analysis.